If we lose the key or the console password for our backups, then how do we get in?

Start

A backup key, console password or recovery credential cannot be found

A backup that cannot be decrypted, or a console no one can sign into, is lost. A restore test finds this failure late, so the first rule is to say so now and not wait for the next test. This flow gets you back in if the way in was planned, and says what to do if it was not.

• Then: Tell the backup owner now; do not wait for the next test

Step

Tell the backup owner now; do not wait for the next test

The pack says to treat a backup whose key cannot be found as lost and to tell the backup owner now. The backup owner is accountable for the backup system, its protection and its restore tests. Note when you found the loss and which keys, consoles or data sets it touches, so the owner can see what is affected.

• Then: Could someone without authority have reached, removed or changed it?

Decision

Could someone without authority have reached, removed or changed it?

A missing key or a password that no longer works can be an attacker's work, since attackers look for the backups first. Look for a changed password, an unexpected sign-in, a deleted key or a deleted backup set. Answer yes if you cannot rule it out.

• Yes, or not known: Tell the incident manager at once; P09 takes over
• No, nothing suggests it: Does the key register name its location and two holders?

Outcome

Tell the incident manager at once; P09 takes over

A backup copy that has been deleted, changed or reached by someone who should not have it goes to the incident manager at once. The incident plan decides what is stopped, what is protected and what is restored, and who decides each. This flow changes none of that. Where the loss meets a live recovery, the choice of copy is P22's and P09's.

Decision

Does the key register name its location and two holders?

The keys and recovery credentials for the backup system are meant to be kept outside the estate that is backed up, with at least two named people able to reach them when production is down. The key register records where each one is kept and who those people are. Answer no if there is no register, the entry is missing, or you cannot reach it without a production system.

• Yes, it does: Have a named holder recover it without any production system
• No, or not known: Does a supplier run the backups or the console?

Step

Have a named holder recover it without any production system

The named person goes to the place the register gives, which is outside the backed-up estate, and recovers the key or credential. Keep the matrix, the suppliers' contacts and the instructions on paper or offline with the incident response plan, so you can open them when the main systems are down. Write down the date.

• Then: Does it decrypt a copy or sign in to the console?

Decision

Does it decrypt a copy or sign in to the console?

Check the recovered key against a real copy, not against the register's say-so. A key that is found but does not open the copy gives you no way in, so carry on to the next route. Try a copy of a critical data set first, and check its integrity before you restore it.

• Yes, it works: Fix the gap: register entry, two holders, a place outside the estate
• No, it does not: Does a supplier run the backups or the console?

Decision

Does a supplier run the backups or the console?

A supplier that runs a backup runs part of your procedure. Ask what the contract says about getting the way in back. The contract should give a restore time no longer than the service's recovery time. Where the supplier holds the console, ask the supplier through the contact you keep offline. Answer yes if any part is run by a supplier.

• Yes, or not known: Ask the supplier to restore access, via your offline contact
• No, we run them ourselves: Does the console's tenant have a break-glass account?

Step

Ask the supplier to restore access, via your offline contact

Use the supplier contact held where it can be reached when the main systems are down. Ask what the contract says about recovering access to the console or the key it holds, and how long it takes. If the supplier gives no restore time, or will not share its restore results, record a failed check and press for a contract change.

• Then: Did that give you the key or a way into the console?

Decision

Does the console's tenant have a break-glass account?

Backup administration is meant to be separate from the production sign-in directory, so a production administrator account is not the way in. If the console signs in through its own cloud identity tenant or administration portal, your privileged access standard may require break-glass accounts for it. Using one means declaring the use before or at the time of use, then a review of what it did and a credential change, each within 1 working day by the privileged access pack's default.

• Yes, it has one: Use break-glass, declare it, change the credential after
• No, or not known: Does another copy of each affected data set decrypt and restore?

Step

Use break-glass, declare it, change the credential after

Break-glass accounts are for the day the normal route fails and for nothing else. Declare the use to the person the standard names before signing in, or at once after, and confirm that the alert fired. Within 1 working day, by the privileged access pack's default, have every action reviewed against the stated reason, and change the password and reseal it.

• Then: Did the break-glass account give you a way in?

Decision

Does another copy of each affected data set decrypt and restore?

A critical data set should have at least three copies on two kinds of storage, with one immutable or offline. A different copy with its own reachable key may still be good, so try it. Check its integrity before you restore, and restore it into an isolated place. If the same key unlocks every copy of a data set, the answer is no.

• Yes, one does: Fix the gap: register entry, two holders, a place outside the estate
• No, or not known: No backup for the data set: tell its owner the same day

Outcome

No backup for the data set: tell its owner the same day

A backup whose key cannot be found is treated as lost. The pack's rule for a failed job that leaves a data set outside its recovery point is that the data owner is told the same day and decides whether the service can carry the exposure until a good copy exists. Apply the same here. Take a new backup now with its key kept as the pack says, and raise a finding for the protection controls that failed. If this meets a live recovery, the incident manager and the recovery plan decide which copy to use.

Step

Fix the gap: register entry, two holders, a place outside the estate

Write the key into the key register with where it is kept and two named people who can reach it when production is down. Keep a copy of the matrix, the suppliers' contacts and the instructions to recover keys where they can be opened without the main systems. Raise a finding for any protection control that was not met or not checked; an unchecked protection is an unproven one.

• Then: You are in; prove the way in at the next test with someone else

Outcome

You are in; prove the way in at the next test with someone else

In the next restore test, a named person who is not the usual backup administrator recovers a key from the register and decrypts a copy, and writes down the date. That is the proof the pack asks for, and it shows the register is true. Check also that the matrix, contacts and instructions open from where they are kept.

Decision

Did that give you the key or a way into the console?

Test it the same way as a key you found: does it decrypt a copy or sign you in to the console? If the supplier says it is done but you cannot sign in, treat it as not done and try the next route.

• Yes, it works: Fix the gap: register entry, two holders, a place outside the estate
• No, or not known: Does the console's tenant have a break-glass account?

Decision

Did the break-glass account give you a way in?

Sign in and open a backup you can read. Declare the use, and change the credential afterwards, as the step before says. If it does not work, treat the way in as lost and check whether another copy still restores.

• Yes, it works: Fix the gap: register entry, two holders, a place outside the estate
• No, or not known: Does another copy of each affected data set decrypt and restore?